Must-have skills:-

Azure platform security (primary):-

• Microsoft Entra ID (Azure AD): app registrations, service principals, OAuth2 scopes, delegated vs application permissions, On-Behalf-Of (OBO) token flows, consent model, resource-scoped permissions (Exchange App RBAC, RSC-style scoping)


• Azure API Management (APIM): authoring and staging policies, per-client policy keyed on client ID, correlation-ID handling, content-safety and token-limit policies


• Azure networking: NSGs, firewall / egress rules, private endpoints / private connectivity, subnet segmentation


• Azure observability: Azure Monitor diagnostic settings, Log Analytics, Microsoft Sentinel, OpenTelemetry, KQL for validation and evidence queries

Engineering and DevOps:-

• Reading and reasoning about application source code to derive least-privilege scope (which MCP servers, tools, and Graph resources an agent actually calls, read vs write, target resources). This is the load-bearing skill for DC-IAM-1


• Building a shared instrumentation library / SDK (structured event emission, schema conformance, mandatory-by-design)


• CI/CD and staged promotion through environments (DEV to UAT), infrastructure-as-config discipline


• Comfort with a native-first, GA-only stance: prefer existing generally-available Azure controls over custom code; no preview-tier dependencies

Security engineering practice:

• Default-deny and least-privilege as defaults


• Fail-closed design (a control failure must never become a bypass)


• Proving enforcement with a negative test (the disallowed path is shown to be blocked, not just the allowed path working)


• Producing audit-grade evidence: before/after permission exports, allow/deny matrices, tamper/bypass tests, control-design and procedure writeups

Nice to Have:-

• PlainID or another externalized policy decision point (PDP) / policy-based access control


• AI agent platforms, LLM gateways, MCP (Model Context Protocol) hubs and connectors


• LangSmith or similar LLM tracing tools Postgres (the MCP hub registration / scope model runs on it)


• Prior work in a regulated / financial-services environment and familiarity with control-audit expectations (design gates, ARB / TRC / SOC sign-off)


• Guardrail and content-safety tooling (Azure Content Safety, Prompt Shields, Groundedness)

Working conditions and expectations

• Ground rules: native-first and GA-only; default-deny; fail closed for high-risk; one correlation ID end to end; confirm before changing shared platform config (APIM, network, identity changes affect every agent, so stage in DEV/UAT and validate before handoff)


• Release model: build and stage each control through DEV then UAT, complete positive and negative validation and sign-off at UAT, then hand off to the client, who promotes to PROD through their own change management


• Cadence: two-week sprints; MVP (audit-defensible, may be manual or lean on an existing process) for 7 of 8 controls by 9/25, then hardening to fully operational with evidence by mid-November


• Collaboration: coordinate with client platform (Calvin's team), Cloud (network segmentation), and SecOps (dashboards, log-schema ingestion); design gates reviewed by ARB / TRC / SOC before UAT-to-client handoff


• The real floor on speed is the DEV-to-UAT promotion cadence and per-control validation, not coding time. We build with AI coding agents assisting, so mechanical authoring compresses; the validation and sign-off floor does not

What success looks like:-

• 7 of 8 platform controls at a minimally defensible (audit-holds-up) state by 9/25, DC-OBS-9 shortly after


• Each control shipped with the three-artifact trio: control design, documented procedures, and a test plan with evidence including the negative test


• Full McKinsey-built set hardened to fully operational with evidence by mid-November